1. Field of the Invention
The present invention relates generally to systems for securing computing devices, and in particular to systems for securing the access to systems for establishing computer system settings or configurations.
2. Description of the Prior Art
Many personal computers have an administrative password, which must be entered in order to change system settings or other critical parameters that the user should not normally alter. In IBM ThinkPad laptop computers, this is known as the Privilege Access Password, or PAP.
In larger corporate organizations, the computer support group often wants to keep these passwords secret, except when it is necessary to have a user modify the setting that are under its control. If each computer is loaded with a different password, this presents a sizeable logistical problem in keeping track of the password corresponding to each individual computer.
Similarly, when shipping PCs from point A to point B. it is helpful to be able to xe2x80x9clockxe2x80x9d the systems with a combination of PAP and Power On Password (POP), to deter theft of the PC in transit. Again, if many computers are being shipped, and each computer is loaded with a different password, this presents the same sizeable logistical problem in keeping track of the password corresponding to each individual computer.
The help desk for end-user support would like a way to quickly and easily find the password for any user""s machine, while that user is on the telephone with the problem. The help desk consultant can then provide the password to the user over the phone. Following the consultant""s instructions, the user can then enter the password, enabling the system configuration changes that are needed to solve his or her problem. It should be difficult, however, to find the password for a given machine without consulting with the help desk team.
In a similar way, the recipient of a shipment of computers would like to be able to unlock them, by quickly determining the password of the systems received, without worrying about waiting for the passwords to be shipped separately.
It is one objective of the present invention to provide a method and apparatus for use in a data processing system which allows for password protection of access to software control systems which may be utilized to modify data processing system configuration selections previously made by an authorized user having knowledge of the password.
It is another objective of the present invention to provide such protection of system configurations selections in a manner which allows the system configuration protection to be implemented on an enterprise level in an organization having a plurality of data processing systems dispensed to a plurality of authorized users, and which allows a service authority within the enterprise to quickly and easily generate and issue the system configuration passwords to the individual users to allow (and thereafter protect) system configuration selections.
It is yet another object of the present invention to generate such system configuration passwords by utilizing a unique, but not necessarily secret, identifier of each one of said plurality of data processing systems, and an enterprise-wide secret key, to be provided as inputs to at least one one-way hash function, in order to develop a hash output string, which can be further processed in order to develop said system configuration passwords which are unique for each data processing system.
These and other objectives are obtained as is now described. A method and apparatus is provided for securing computer configuration of a plurality of data processing systems in a particular organization. A plurality of data processing systems are provided. For the plurality of data processing systems an identifying information type is selected, which relatively uniquely identifies each of the plurality of data processing systems from one another, but which is not necessarily secret. In the preferred embodiment, this identifying information may constitute the serial number of the data processing systems. Then, for the particular organization, an organization password is selected which defines a relatively secret organization cryptographic key. Then at least one cryptographic hash function is provided. The cryptographic hash function receives as an input the particular identifying information of a particular one of the plurality of data processing systems and the particular organization password. The cryptographic function generates a hash output which can be processed to develop a relatively unique (and seemingly random) configuration protection password for the particular data processing system. This is repeated for all the data processing systems so that each has its own relatively unique configuration protection password. Then, system configuration watchdog software modules are loaded onto each of the plurality of data processing systems. The watchdog software operates to monitor for user requests for access to changes in at least one of a plurality of protected computer configuration attributes, and challenges the user to enter a password. If a correct password is entered, the configuration of the computer may be changed; however, if the correct password is not entered, access to changing the configuration of the computer system is denied. The plurality of relatively unique configuration protection passwords are generated, one for each one of the data processing systems in the set, and are distributed to authorized users in mass or individually, as contact is made with the system administration. Thereafter, the watchdog software is utilized to prevent changes in system configuration, unless the correct password is entered.
The above as well as additional objectives, features, and advantages of the present invention will become apparent in the following detailed written description.